ship18ion 1.2.0 → 1.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 champ18ion
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/engine/ast.d.ts

@@ -0,0 +1,6 @@
+export interface EnvUsage {
+    name: string;
+    line: number;
+    file: string;
+}
+export declare function findEnvUsages(filePath: string): EnvUsage[];

package/dist/engine/config.d.ts

@@ -0,0 +1,12 @@
+export interface Ship18ionConfig {
+    env?: {
+        required?: string[];
+        disallowed?: string[];
+    };
+    security?: {
+        noCorsWildcard?: boolean;
+        requireRateLimit?: boolean;
+    };
+    ignore?: string[];
+}
+export declare function loadConfig(cwd?: string): Promise<Ship18ionConfig>;

package/dist/engine/detector.d.ts

@@ -0,0 +1,2 @@
+export type FrameworkType = 'nextjs' | 'remix' | 'vite' | 'nestjs' | 'express' | 'fastify' | 'Node.js / Generic' | 'unknown';
+export declare function detectFramework(cwd: string): Promise<FrameworkType>;

package/dist/engine/runner.d.ts

@@ -0,0 +1,3 @@
+import { Ship18ionConfig } from './config';
+import { RuleResult } from './types';
+export declare function runChecks(config: Ship18ionConfig, cwd: string, onProgress?: (stage: string) => void): Promise<RuleResult[]>;

package/dist/engine/scanner.d.ts

@@ -0,0 +1 @@
+export declare function scanFiles(cwd: string, ignore?: string[]): Promise<string[]>;

package/dist/engine/secrets.d.ts

@@ -0,0 +1,6 @@
+export declare const SECRET_PATTERNS: {
+    name: string;
+    regex: RegExp;
+}[];
+export declare function calculateEntropy(str: string): number;
+export declare function isHighEntropy(str: string, threshold?: number): boolean;

package/{src/engine/types.ts → dist/engine/types.d.ts}

@@ -1,17 +1,15 @@
-import { Ship18ionConfig } from './config';
-import { FrameworkType } from './detector';
-
-export interface RuleResult {
-    status: 'pass' | 'fail' | 'warn';
-    message: string;
-    file?: string;
-    line?: number;
-    ruleId: string;
-}
-
-export interface RuleContext {
-    config: Ship18ionConfig;
-    files: string[];
-    cwd: string;
-    framework: FrameworkType;
-}
+import { Ship18ionConfig } from './config';
+import { FrameworkType } from './detector';
+export interface RuleResult {
+    status: 'pass' | 'fail' | 'warn';
+    message: string;
+    file?: string;
+    line?: number;
+    ruleId: string;
+}
+export interface RuleContext {
+    config: Ship18ionConfig;
+    files: string[];
+    cwd: string;
+    framework: FrameworkType;
+}

package/dist/reporters/console.d.ts

@@ -0,0 +1,2 @@
+import { RuleResult } from '../engine/types';
+export declare function reportConsole(results: RuleResult[], cwd: string, framework?: string): void;

package/dist/rules/build.d.ts

@@ -0,0 +1,3 @@
+import { RuleContext, RuleResult } from '../engine/types';
+export declare function checkDependencies(ctx: RuleContext): Promise<RuleResult[]>;
+export declare function checkBuild(ctx: RuleContext): Promise<RuleResult[]>;

package/dist/rules/env.d.ts

@@ -0,0 +1,2 @@
+import { RuleContext, RuleResult } from '../engine/types';
+export declare function checkEnvVars(ctx: RuleContext): Promise<RuleResult[]>;

package/dist/rules/frameworks/nextjs.d.ts

@@ -0,0 +1,2 @@
+import { RuleContext, RuleResult } from '../../engine/types';
+export declare function checkNextJs(ctx: RuleContext): Promise<RuleResult[]>;

package/dist/rules/git.d.ts

@@ -0,0 +1,2 @@
+import { RuleContext, RuleResult } from '../engine/types';
+export declare function checkGit(ctx: RuleContext): Promise<RuleResult[]>;

package/dist/rules/hygiene.d.ts

@@ -0,0 +1,2 @@
+import { RuleContext, RuleResult } from '../engine/types';
+export declare function checkHygiene(ctx: RuleContext): Promise<RuleResult[]>;

package/dist/rules/packages.d.ts

@@ -0,0 +1,2 @@
+import { RuleContext, RuleResult } from '../engine/types';
+export declare function checkPackages(ctx: RuleContext): Promise<RuleResult[]>;

package/dist/rules/secrets.d.ts

@@ -0,0 +1,2 @@
+import { RuleContext, RuleResult } from '../engine/types';
+export declare function checkSecrets(ctx: RuleContext): Promise<RuleResult[]>;

package/dist/rules/security.d.ts

@@ -0,0 +1,2 @@
+import { RuleContext, RuleResult } from '../engine/types';
+export declare function checkSecurity(ctx: RuleContext): Promise<RuleResult[]>;

package/package.json

@@ -1,11 +1,17 @@
 {
   "name": "ship18ion",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "",
   "main": "dist/cli/index.js",
   "bin": {
     "ship18ion": "./dist/cli/index.js"
   },
+  "files": [
+    "dist",
+    "README.md",
+    "CONTRIBUTING.md",
+    "LICENSE"
+  ],
   "scripts": {
     "build": "tsc",
     "prepublishOnly": "npm run build",
@@ -21,8 +27,8 @@
     "deployment",
     "linter"
   ],
-  "author": "TRIPLE HASH",
-  "license": "ISC",
+  "author": "champ18ion",
+  "license": "MIT",
   "dependencies": {
     "@babel/parser": "^7.28.5",
     "@babel/traverse": "^7.28.5",

package/src/cli/index.ts

@@ -1,56 +0,0 @@
-#!/usr/bin/env node
-import { Command } from 'commander';
-import chalk from 'chalk';
-import { loadConfig } from '../engine/config';
-import { runChecks } from '../engine/runner';
-import { reportConsole } from '../reporters/console';
-
-const program = new Command();
-
-import figlet from 'figlet';
-import gradient from 'gradient-string';
-import ora from 'ora';
-import { detectFramework } from '../engine/detector';
-
-program
-    .command('check', { isDefault: true })
-    .description('Run production readiness checks')
-    .option('--ci', 'Run in CI mode (minimal output, exit codes)')
-    .action(async (options) => {
-        if (!options.ci) {
-            console.log(gradient.pastel.multiline(figlet.textSync('SHIP18ION')));
-            console.log(chalk.dim('Production Readiness Inspector\n'));
-        }
-
-        const cwd = process.cwd();
-        const config = await loadConfig(cwd);
-        const spinner = ora('Initializing...').start();
-
-        try {
-            let framework: string = 'unknown';
-            if (!options.ci) {
-                framework = await detectFramework(cwd);
-                spinner.text = `Detected Framework: ${chalk.cyan(framework.toUpperCase())}`;
-                await new Promise(r => setTimeout(r, 800)); // Brief pause to show framework
-            } else {
-                // Even in CI, simple detection is useful for reporting if needed, or we just skip
-                framework = await detectFramework(cwd);
-            }
-
-            const results = await runChecks(config, cwd, (stage) => {
-                if (!options.ci) spinner.text = stage;
-            });
-
-            spinner.succeed(chalk.green('Checks completed!'));
-            console.log('');
-
-            // Uses console reporter for both normal and CI for now (it handles exit codes)
-            reportConsole(results, cwd, framework);
-        } catch (e) {
-            spinner.fail(chalk.red('Error running checks'));
-            console.error(e);
-            process.exit(1);
-        }
-    });
-
-program.parse(process.argv);

package/src/engine/ast.ts

@@ -1,84 +0,0 @@
-import fs from 'fs';
-import * as parser from '@babel/parser';
-import traverse from '@babel/traverse';
-import * as t from '@babel/types';
-
-export interface EnvUsage {
-    name: string;
-    line: number;
-    file: string;
-}
-
-export function findEnvUsages(filePath: string): EnvUsage[] {
-    if (!fs.existsSync(filePath)) return [];
-
-    const code = fs.readFileSync(filePath, 'utf-8');
-    const usages: EnvUsage[] = [];
-
-    // Only parse JS/TS files
-    if (!/\.(js|ts|jsx|tsx)$/.test(filePath)) {
-        return [];
-    }
-
-    try {
-        const ast = parser.parse(code, {
-            sourceType: 'module',
-            plugins: ['typescript', 'jsx'],
-        });
-
-        traverse(ast, {
-            MemberExpression(path) {
-                // 1. Check for process.env.VAR
-                if (
-                    t.isMemberExpression(path.node.object) &&
-                    t.isIdentifier(path.node.object.object) &&
-                    path.node.object.object.name === 'process' &&
-                    t.isIdentifier(path.node.object.property) &&
-                    path.node.object.property.name === 'env'
-                ) {
-                    if (t.isIdentifier(path.node.property)) {
-                        usages.push({
-                            name: path.node.property.name,
-                            line: path.node.loc?.start.line || 0,
-                            file: filePath
-                        });
-                    } else if (t.isStringLiteral(path.node.property)) {
-                        usages.push({
-                            name: path.node.property.value,
-                            line: path.node.loc?.start.line || 0,
-                            file: filePath
-                        });
-                    }
-                }
-
-                // 2. Check for import.meta.env.VAR (Vite)
-                // AST structure: MemberExpression
-                //   object: MemberExpression
-                //     object: MetaProperty (import.meta)
-                //     property: Identifier (env)
-                //   property: Identifier (VAR)
-
-                if (
-                    t.isMemberExpression(path.node.object) &&
-                    t.isMetaProperty(path.node.object.object) &&
-                    path.node.object.object.meta.name === 'import' &&
-                    path.node.object.object.property.name === 'meta' &&
-                    t.isIdentifier(path.node.object.property) &&
-                    path.node.object.property.name === 'env'
-                ) {
-                    if (t.isIdentifier(path.node.property)) {
-                        usages.push({
-                            name: path.node.property.name,
-                            line: path.node.loc?.start.line || 0,
-                            file: filePath
-                        });
-                    }
-                }
-            }
-        });
-
-    } catch (e) {
-        // console.warn(`Failed to parse ${filePath}:`, e);
-    }
-    return usages;
-}

package/src/engine/config.ts

@@ -1,28 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-export interface Ship18ionConfig {
-    env?: {
-        required?: string[];
-        disallowed?: string[];
-    };
-    security?: {
-        noCorsWildcard?: boolean;
-        requireRateLimit?: boolean;
-    };
-    ignore?: string[];
-}
-
-export async function loadConfig(cwd: string = process.cwd()): Promise<Ship18ionConfig> {
-    const configPath = path.join(cwd, 'ship18ion.config.json');
-    if (fs.existsSync(configPath)) {
-        const content = fs.readFileSync(configPath, 'utf-8');
-        try {
-            return JSON.parse(content);
-        } catch (e) {
-            console.error('Failed to parse config file:', e);
-            return {};
-        }
-    }
-    return {};
-}

package/src/engine/detector.ts

@@ -1,27 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-export type FrameworkType = 'nextjs' | 'remix' | 'vite' | 'nestjs' | 'express' | 'fastify' | 'Node.js / Generic' | 'unknown';
-
-export async function detectFramework(cwd: string): Promise<FrameworkType> {
-    const pkgPath = path.join(cwd, 'package.json');
-    if (!fs.existsSync(pkgPath)) {
-        return 'unknown';
-    }
-
-    try {
-        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
-        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-
-        if (deps['next']) return 'nextjs';
-        if (deps['@remix-run/react']) return 'remix';
-        if (deps['vite']) return 'vite';
-        if (deps['@nestjs/core']) return 'nestjs';
-        if (deps['express']) return 'express';
-        if (deps['fastify']) return 'fastify';
-
-        return 'Node.js / Generic';
-    } catch (e) {
-        return 'unknown';
-    }
-}

package/src/engine/runner.ts

@@ -1,62 +0,0 @@
-import { Ship18ionConfig } from './config';
-import { scanFiles } from './scanner';
-import { RuleContext, RuleResult } from './types';
-import { checkEnvVars } from '../rules/env';
-import { checkSecrets } from '../rules/secrets';
-import { checkSecurity } from '../rules/security';
-import { checkDependencies, checkBuild } from '../rules/build';
-import { checkHygiene } from '../rules/hygiene';
-import { checkPackages } from '../rules/packages';
-import { checkNextJs } from '../rules/frameworks/nextjs';
-import { checkGit } from '../rules/git';
-
-import { detectFramework } from './detector';
-
-export async function runChecks(
-    config: Ship18ionConfig,
-    cwd: string,
-    onProgress?: (stage: string) => void
-): Promise<RuleResult[]> {
-    if (onProgress) onProgress('Scanning files...');
-    const files = await scanFiles(cwd, config.ignore);
-    // Framework detection
-    const framework = await detectFramework(cwd);
-
-    const ctx: RuleContext = { config, files, cwd, framework };
-
-    const results: RuleResult[] = [];
-
-    // Run all checks
-    if (onProgress) onProgress('Checking environment variables...');
-    results.push(...await checkEnvVars(ctx));
-
-    if (onProgress) onProgress('Scanning for secrets...');
-    results.push(...await checkSecrets(ctx));
-
-    if (onProgress) onProgress('Analyzing security configurations...');
-    results.push(...await checkSecurity(ctx));
-
-    if (onProgress) onProgress('Verifying dependencies...');
-    results.push(...await checkDependencies(ctx));
-
-    if (onProgress) onProgress('Inspecting build artifacts...');
-    results.push(...await checkBuild(ctx));
-
-    // New Rules
-    if (onProgress) onProgress('Checking code hygiene...');
-    results.push(...await checkHygiene(ctx));
-
-    if (onProgress) onProgress('Validating packages...');
-    results.push(...await checkPackages(ctx));
-
-    // Framework specific checks
-    if (framework === 'nextjs') {
-        if (onProgress) onProgress('Running Next.js specific checks...');
-        results.push(...await checkNextJs(ctx));
-    }
-
-    if (onProgress) onProgress('Checking git status...');
-    results.push(...await checkGit(ctx));
-
-    return results;
-}

package/src/engine/scanner.ts

@@ -1,22 +0,0 @@
-import { glob } from 'glob';
-import path from 'path';
-
-export async function scanFiles(cwd: string, ignore: string[] = []): Promise<string[]> {
-    // Ignore build artifacts, node_modules, and git
-    const defaultIgnore = [
-        '**/node_modules/**',
-        '**/.git/**',
-        '**/dist/**',
-        '**/build/**',
-        '**/.next/**',
-        '**/.turbo/**',
-        '**/coverage/**'
-    ];
-    // Scan for relevant files: JS/TS code, Configs (JSON/YAML), Env files
-    return glob('**/*.{js,ts,jsx,tsx,json,yaml,yml,env,env.*}', {
-        cwd,
-        ignore: [...defaultIgnore, ...ignore],
-        absolute: true,
-        dot: true, // Include .env files
-    });
-}

package/src/engine/secrets.ts

@@ -1,26 +0,0 @@
-export const SECRET_PATTERNS = [
-    { name: 'AWS Access Key', regex: /AKIA[0-9A-Z]{16}/ },
-    { name: 'Google API Key', regex: /AIza[0-9A-Za-z\\-_]{35}/ },
-    { name: 'Stripe Secret Key', regex: /sk_live_[0-9a-zA-Z]{24}/ },
-    { name: 'GitHub Personal Access Token', regex: /ghp_[0-9a-zA-Z]{36}/ },
-    { name: 'Generic Private Key', regex: /-----BEGIN .* PRIVATE KEY-----/ },
-    { name: 'Slack Bot Token', regex: /xoxb-[0-9]{11}-[0-9]{12}-[0-9a-zA-Z]{24}/ },
-    { name: 'OpenAI API Key', regex: /sk-[a-zA-Z0-9]{48}/ }
-];
-
-export function calculateEntropy(str: string): number {
-    const len = str.length;
-    const frequencies = Array.from(str).reduce((freq, char) => {
-        freq[char] = (freq[char] || 0) + 1;
-        return freq;
-    }, {} as Record<string, number>);
-
-    return Object.values(frequencies).reduce((sum, f) => {
-        const p = f / len;
-        return sum - (p * Math.log2(p));
-    }, 0);
-}
-
-export function isHighEntropy(str: string, threshold = 4.5): boolean {
-    return calculateEntropy(str) > threshold;
-}

package/src/reporters/console.ts

@@ -1,69 +0,0 @@
-import chalk from 'chalk';
-import path from 'path';
-import { RuleResult } from '../engine/types';
-
-const CATEGORIES: Record<string, { icon: string; label: string }> = {
-    'env': { icon: '🌱', label: 'Environment' },
-    'secret': { icon: '🔐', label: 'Secrets' },
-    'security': { icon: '⚠️', label: 'Security' },
-    'dep': { icon: '📦', label: 'Dependency & Build' },
-    'build': { icon: '📦', label: 'Dependency & Build' },
-    'git': { icon: '🐙', label: 'Git & Repo' },
-    'hygiene': { icon: '🧹', label: 'Code Hygiene' },
-    'package': { icon: '📦', label: 'Packages' },
-};
-
-function getCategory(ruleId: string) {
-    const prefix = ruleId.split('-')[0];
-    return CATEGORIES[prefix] || { icon: '❓', label: 'Other' };
-}
-
-export function reportConsole(results: RuleResult[], cwd: string, framework?: string) {
-    if (framework) {
-        console.log(chalk.blue(`ℹ️  Framework: ${framework.toUpperCase()}`));
-    }
-
-    if (results.length === 0) {
-        console.log(chalk.green('\n✅  Production Readiness Check Passed!\n'));
-        return;
-    }
-
-    const fails = results.filter(r => r.status === 'fail');
-    const warns = results.filter(r => r.status === 'warn');
-
-    if (fails.length > 0) {
-        console.log(chalk.red('\n❌  Production Readiness Check Failed\n'));
-    } else {
-        console.log(chalk.yellow('\n⚠️  Production Readiness Check Passed with Warnings\n'));
-    }
-
-    // Group by category
-    const grouped: Record<string, RuleResult[]> = {};
-    results.forEach(r => {
-        const cat = getCategory(r.ruleId);
-        const key = `${cat.icon} ${cat.label}`;
-        if (!grouped[key]) grouped[key] = [];
-        grouped[key].push(r);
-    });
-
-    for (const [category, items] of Object.entries(grouped)) {
-        console.log(chalk.bold(category));
-        for (const item of items) {
-            const sym = item.status === 'fail' ? chalk.red('✖') : chalk.yellow('!');
-            const location = item.file ? `${path.relative(cwd, item.file)}${item.line ? `:${item.line}` : ''}` : '';
-            console.log(`  ${sym} ${item.message} ${chalk.gray(location)}`);
-        }
-        console.log('');
-    }
-
-    const summary = [];
-    if (fails.length > 0) summary.push(chalk.red(`${fails.length} errors`));
-    if (warns.length > 0) summary.push(chalk.yellow(`${warns.length} warnings`));
-
-    console.log(`Summary: ${summary.join(', ')}`);
-    console.log('');
-
-    if (fails.length > 0) {
-        process.exit(1);
-    }
-}

package/src/rules/build.ts

@@ -1,77 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import { RuleContext, RuleResult } from '../engine/types';
-
-export async function checkDependencies(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-
-    const packageJsons = ctx.files.filter(f => f.endsWith('package.json') && !f.includes('node_modules'));
-
-    const devToolsInProd = ['eslint', 'jest', 'mocha', 'nodemon', 'ts-node', 'typescript', 'webpack', 'babel-loader'];
-
-    for (const pkgFile of packageJsons) {
-        try {
-            const content = JSON.parse(fs.readFileSync(pkgFile, 'utf-8'));
-            const deps = content.dependencies || {};
-
-            for (const tool of devToolsInProd) {
-                if (deps[tool]) {
-                    results.push({
-                        status: 'warn',
-                        message: `Dev dependency found in 'dependencies': ${tool}. Should be in 'devDependencies'?`,
-                        ruleId: 'dep-dev-in-prod',
-                        file: pkgFile
-                    });
-                }
-            }
-        } catch (e) {
-            // ignore
-        }
-    }
-    return results;
-}
-
-import { glob } from 'glob';
-
-export async function checkBuild(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-
-    // Explicitly scan build folders (dist, build, .next, .output) for dangerous files
-    // The main scanner ignores these, so we check them separately here.
-
-    const buildDirs = ['dist', 'build', '.next', '.output'];
-    const foundBuildDirs = buildDirs.filter(d => fs.existsSync(path.join(ctx.cwd, d)));
-
-    if (foundBuildDirs.length === 0) {
-        return results;
-    }
-
-    // 1. Check for Source Maps (.map)
-    // We search inside the found build directories
-    for (const dir of foundBuildDirs) {
-        const mapFiles = await glob(`${dir}/**/*.map`, { cwd: ctx.cwd, absolute: true });
-
-        if (mapFiles.length > 0) {
-            results.push({
-                status: 'warn',
-                message: `Found ${mapFiles.length} source map files in '${dir}' (e.g. ${path.basename(mapFiles[0])}). Ensure these are not exposed publicly.`,
-                ruleId: 'build-source-map',
-                file: dir // Point to the directory itself
-            });
-        }
-
-        // 2. Check for .env files in build output
-        // We look for .env* files inside the build dir
-        const envFiles = await glob(`${dir}/**/*.env*`, { cwd: ctx.cwd, absolute: true });
-        for (const file of envFiles) {
-            results.push({
-                status: 'fail',
-                message: `Environment file found in build output (${dir})!`,
-                ruleId: 'build-env-leak',
-                file
-            });
-        }
-    }
-
-    return results;
-}

package/src/rules/env.ts

@@ -1,99 +0,0 @@
-import fs from 'fs';
-import dotenv from 'dotenv';
-import { RuleContext, RuleResult } from '../engine/types';
-import { findEnvUsages } from '../engine/ast';
-
-export async function checkEnvVars(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-    const declaredEnvs = new Set<string>();
-    const usedEnvs = new Map<string, { file: string, line: number }[]>();
-
-    // 1. Find and parse .env files (definition detection)
-    const envFiles = ctx.files.filter(f => f.match(/\.env(\..+)?$/));
-    for (const file of envFiles) {
-        const content = fs.readFileSync(file, 'utf-8');
-        try {
-            const parsed = dotenv.parse(content);
-            Object.keys(parsed).forEach(k => declaredEnvs.add(k));
-        } catch (e) {
-            results.push({
-                status: 'warn',
-                message: `Failed to parse env file: ${file}`,
-                ruleId: 'env-parse-error',
-                file: file
-            });
-        }
-    }
-
-    // 2. Scan for usages
-    const codeFiles = ctx.files.filter(f => f.match(/\.(js|ts|jsx|tsx)$/));
-    for (const file of codeFiles) {
-        const usages = findEnvUsages(file);
-        for (const u of usages) {
-            if (!usedEnvs.has(u.name)) {
-                usedEnvs.set(u.name, []);
-            }
-            usedEnvs.get(u.name)?.push({ file, line: u.line });
-        }
-    }
-
-    // 3. Rule: Unused env vars
-    // Fail if Env vars exist but never used
-    for (const env of declaredEnvs) {
-        if (!usedEnvs.has(env)) {
-            // Ignore some common framework vars if needed, but strict mode says unused is bad.
-            results.push({
-                status: 'warn', // Warn for now, maybe fail? User said "Fail if Env vars exist but never used"
-                message: `Unused environment variable: ${env}`,
-                ruleId: 'env-unused',
-                file: envFiles[0] // Just point to first env file for now
-            });
-        }
-    }
-
-    // 4. Rule: Missing required env vars
-    // "App references process.env.X But it’s not defined anywhere"
-    // Also check strict list from config
-    const required = ctx.config.env?.required || [];
-
-    // Check missing from strict config
-    for (const req of required) {
-        if (!declaredEnvs.has(req)) {
-            results.push({
-                status: 'fail',
-                message: `Missing required environment variable (configured): ${req}`,
-                ruleId: 'env-missing-config',
-            });
-        }
-    }
-
-    // Check usage without definition
-    const commonSystemVars = ['NODE_ENV', 'PORT', 'CI'];
-    for (const [env, locs] of usedEnvs) {
-        if (!declaredEnvs.has(env) && !commonSystemVars.includes(env)) {
-            // Check if it is in disallowed list?
-            if (ctx.config.env?.disallowed?.includes(env)) {
-                results.push({
-                    status: 'fail',
-                    message: `Disallowed environment variable used: ${env}`,
-                    ruleId: 'env-disallowed',
-                    file: locs[0].file,
-                    line: locs[0].line
-                });
-            } else {
-                // It's used but not in .env. 
-                // We should probably warn unless we are in strict mode.
-                // User said: "Fail if Required env var is missing" -> checking usage implies requirement.
-                results.push({
-                    status: 'warn',
-                    message: `Environment variable used but not defined in .env: ${env}`,
-                    ruleId: 'env-missing-definition',
-                    file: locs[0].file,
-                    line: locs[0].line
-                });
-            }
-        }
-    }
-
-    return results;
-}

package/src/rules/frameworks/nextjs.ts

@@ -1,33 +0,0 @@
-import { RuleContext, RuleResult } from '../../engine/types';
-import { findEnvUsages } from '../../engine/ast';
-
-export async function checkNextJs(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-
-    // 1. Check for NEXT_PUBLIC_ secrets
-    const codeFiles = ctx.files.filter(f => f.match(/\.(js|ts|jsx|tsx)$/));
-
-    for (const file of codeFiles) {
-        const usages = findEnvUsages(file);
-        for (const usage of usages) {
-            if (usage.name.startsWith('NEXT_PUBLIC_')) {
-                // Heuristic: Does it look like a secret?
-                // e.g. NEXT_PUBLIC_SECRET_KEY, NEXT_PUBLIC_API_SECRET
-                if (usage.name.match(/SECRET|PASSWORD|TOKEN|KEY|AUTH/i)) {
-                    // Exception: PUBLIC_KEY is often safe
-                    if (!usage.name.match(/PUBLIC_KEY/i)) {
-                        results.push({
-                            status: 'warn',
-                            message: `Potential secret exposed via NEXT_PUBLIC_ variable: ${usage.name}`,
-                            ruleId: 'nextjs-public-secret',
-                            file: file,
-                            line: usage.line
-                        });
-                    }
-                }
-            }
-        }
-    }
-
-    return results;
-}

package/src/rules/git.ts

@@ -1,95 +0,0 @@
-import { execSync } from 'child_process';
-import { RuleContext, RuleResult } from '../engine/types';
-
-import fs from 'fs';
-import path from 'path';
-
-export async function checkGit(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-
-    try {
-        // ... (Existing git checks) ...
-        // Check for uncommitted changes
-        const status = execSync('git status --porcelain', { cwd: ctx.cwd, encoding: 'utf-8' });
-        if (status.trim().length > 0) {
-            results.push({
-                status: 'warn',
-                message: 'Git working directory is dirty (uncommitted changes). Verify before shipping.',
-                ruleId: 'git-dirty',
-            });
-        }
-
-        // Check current branch
-        const branch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: ctx.cwd, encoding: 'utf-8' }).trim();
-        const allowedBranches = ['main', 'master', 'staging', 'production', 'prod'];
-        if (!allowedBranches.includes(branch)) {
-            // Warn, but maybe less aggressively? Keeping as warn.
-            results.push({
-                status: 'warn',
-                message: `You are on branch '${branch}'. Production builds typically come from main/master.`,
-                ruleId: 'git-branch',
-            });
-        }
-
-        // --- New: .gitignore Check ---
-        const gitignorePath = path.join(ctx.cwd, '.gitignore');
-        if (fs.existsSync(gitignorePath)) {
-            const content = fs.readFileSync(gitignorePath, 'utf-8');
-            const lines = content.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'));
-
-            // Helper to check if item is ignored (naive grep)
-            const isIgnored = (item: string) => lines.some(l => l.includes(item));
-
-            const requiredIgnores = ['node_modules', '.env'];
-            if (ctx.framework === 'nextjs') {
-                requiredIgnores.push('.next');
-            } else if (ctx.framework !== 'unknown') {
-                // For other frameworks, maybe 'dist' or 'build'
-                if (!isIgnored('dist') && !isIgnored('build')) {
-                    // We can't strictly require one, but warn if NEITHER is found? 
-                    // Let's stick to safe defaults.
-                }
-            }
-
-            for (const item of requiredIgnores) {
-                if (!isIgnored(item)) {
-                    results.push({
-                        status: 'warn',
-                        message: `.gitignore is missing '${item}'. This is critical for security and repo size.`,
-                        ruleId: 'git-ignore-missing',
-                        file: gitignorePath
-                    });
-                }
-            }
-
-            // Check for specific dangerous files not being ignored
-            const dangerousPatterns = ['firebase.json', 'serviceAccountKey.json', '*.pem', '*.key'];
-            // This is tricky because firebase.json CAN be committed. serviceAccountKey.json should NOT.
-
-            if (!isIgnored('serviceAccountKey.json')) {
-                // Only warn if the FILE actually exists? Or just warn generic?
-                // Best to warn if the file exists AND isn't ignored.
-                if (fs.existsSync(path.join(ctx.cwd, 'serviceAccountKey.json'))) {
-                    results.push({
-                        status: 'fail',
-                        message: 'serviceAccountKey.json exists but is NOT in .gitignore!',
-                        ruleId: 'git-ignore-auth',
-                        file: gitignorePath
-                    });
-                }
-            }
-
-        } else {
-            results.push({
-                status: 'warn',
-                message: 'No .gitignore file found! node_modules and secrets might be committed.',
-                ruleId: 'git-no-ignore',
-            });
-        }
-
-    } catch (e) {
-        // Not a git repo or git not found
-    }
-
-    return results;
-}

package/src/rules/hygiene.ts

@@ -1,52 +0,0 @@
-import fs from 'fs';
-import { RuleContext, RuleResult } from '../engine/types';
-
-export async function checkHygiene(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-
-    const codeFiles = ctx.files.filter(f =>
-        f.match(/\.(js|ts|jsx|tsx)$/) &&
-        !f.includes('.test.') &&
-        !f.includes('.spec.')
-    );
-
-    for (const file of codeFiles) {
-        const content = fs.readFileSync(file, 'utf-8');
-        const lines = content.split('\n');
-
-        lines.forEach((line, index) => {
-            const lineNum = index + 1;
-
-            // 1. Console Log Check
-            // Allow console.error and console.warn, but warn on console.log
-            if (line.includes('console.log(')) {
-                // Ignore if commented out
-                if (!line.trim().startsWith('//') && !line.trim().startsWith('*')) {
-                    results.push({
-                        status: 'warn',
-                        message: 'Leftover console.log() call detected.',
-                        ruleId: 'hygiene-console-log',
-                        file,
-                        line: lineNum
-                    });
-                }
-            }
-
-            // 2. TODO / FIXME Check
-            if (line.match(/\/\/\s*(TODO|FIXME):/i)) {
-
-                if (line.match(/FIXME/i)) {
-                    results.push({
-                        status: 'warn',
-                        message: 'FIXME comment found. Resolve before shipping.',
-                        ruleId: 'hygiene-fixme',
-                        file,
-                        line: lineNum
-                    });
-                }
-            }
-        });
-    }
-
-    return results;
-}

package/src/rules/packages.ts

@@ -1,33 +0,0 @@
-import fs from 'fs';
-import { RuleContext, RuleResult } from '../engine/types';
-
-export async function checkPackages(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-
-    const packageJsons = ctx.files.filter(f => f.endsWith('package.json') && !f.includes('node_modules'));
-
-    for (const pkgFile of packageJsons) {
-        try {
-            const content = JSON.parse(fs.readFileSync(pkgFile, 'utf-8'));
-            const deps = Object.keys(content.dependencies || {});
-            const devDeps = Object.keys(content.devDependencies || {});
-
-            // Find intersection
-            const duplicates = deps.filter(d => devDeps.includes(d));
-
-            for (const dup of duplicates) {
-                results.push({
-                    status: 'warn',
-                    message: `Package '${dup}' is listed in both 'dependencies' and 'devDependencies'.`,
-                    ruleId: 'package-duplicate',
-                    file: pkgFile
-                });
-            }
-
-        } catch (e) {
-            // ignore malformed json
-        }
-    }
-
-    return results;
-}

package/src/rules/secrets.ts

@@ -1,53 +0,0 @@
-import fs from 'fs';
-import { RuleContext, RuleResult } from '../engine/types';
-import { SECRET_PATTERNS } from '../engine/secrets';
-
-export async function checkSecrets(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-
-    // Skip binary files, lock files, node_modules (already ignored by scanner but specific check here)
-    const filesToCheck = ctx.files.filter(f => !f.match(/\.(png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|lock|pdf)$/));
-
-    for (const file of filesToCheck) {
-        try {
-            const content = fs.readFileSync(file, 'utf-8');
-            const lines = content.split('\n');
-
-            lines.forEach((line, index) => {
-                // Check Regex Patterns
-                for (const pattern of SECRET_PATTERNS) {
-                    if (pattern.regex.test(line)) {
-                        results.push({
-                            status: 'fail',
-                            message: `Potential secret found: ${pattern.name}`,
-                            ruleId: 'secret-pattern',
-                            file,
-                            line: index + 1
-                        });
-                    }
-                }
-
-                // Check Heuristics for assignments
-                // matches "key = '...'"
-                const genericMsg = line.match(/(api_?key|secret|token|password|auth)[\s]*[:=][\s]*['"]([a-zA-Z0-9_\-]{8,})['"]/i);
-                if (genericMsg) {
-                    const match = genericMsg[2];
-                    // Heuristic: Must be > 8 chars and not contain 'process.env' or template placeholders
-                    if (match && match.length > 8 && !line.includes('process.env') && !match.includes('${')) {
-                        results.push({
-                            status: 'warn',
-                            message: `Possible hardcoded secret (heuristic): ${genericMsg[1]}`,
-                            ruleId: 'secret-heuristic',
-                            file,
-                            line: index + 1
-                        });
-                    }
-                }
-            });
-        } catch (e) {
-            // Ignore read errors
-        }
-    }
-
-    return results;
-}

package/src/rules/security.ts

@@ -1,55 +0,0 @@
-import fs from 'fs';
-import { RuleContext, RuleResult } from '../engine/types';
-
-export async function checkSecurity(ctx: RuleContext): Promise<RuleResult[]> {
-    const results: RuleResult[] = [];
-
-    const codeFiles = ctx.files.filter(f => f.match(/\.(js|ts|jsx|tsx|json)$/));
-
-    for (const file of codeFiles) {
-        const content = fs.readFileSync(file, 'utf-8');
-
-        // 1. Check for Hardcoded NODE_ENV not being production?
-        // Actually we want to verify we are NOT hardcoding 'development' in prod context?
-        // Or "Debug / dev configs enabled" -> debug: true
-
-        if (content.match(/debug:\s*true/)) {
-            results.push({
-                status: 'warn',
-                message: 'Debug mode enabled (debug: true) found',
-                ruleId: 'security-debug-enabled',
-                file
-            });
-        }
-
-        // 2. CORS Wildcard
-        // "origin: '*'" or "origin: *"
-        if (content.match(/origin:\s*['"]?\*['"]?/)) {
-            // Default: Enabled (fail on wildcard) unless explicitly set to false
-            if (ctx.config.security?.noCorsWildcard !== false) {
-                results.push({
-                    status: 'fail',
-                    message: 'CORS wildcard origin (*) detected',
-                    ruleId: 'security-cors-wildcard',
-                    file
-                });
-            }
-        }
-
-        // 3. Hardcoded credentials (simple db keywords)
-        // postgres://user:pass@...
-        if (content.match(/:\/\/[a-zA-Z0-9]+:[a-zA-Z0-9]+@/)) {
-            // Exclude localhost
-            if (!content.includes('localhost') && !content.includes('127.0.0.1')) {
-                results.push({
-                    status: 'fail',
-                    message: 'Hardcoded database credentials in connection string',
-                    ruleId: 'security-db-creds',
-                    file
-                });
-            }
-        }
-    }
-
-    return results;
-}

package/tests/fixtures/leaky-app/.env

@@ -1,3 +0,0 @@
-DB_URL=postgres://localhost:5432/db
-UNUSED_VAR=123
-SECRET_KEY=supersecret

package/tests/fixtures/leaky-app/package.json

@@ -1,7 +0,0 @@
-{
-    "name": "leaky-app",
-    "dependencies": {
-        "express": "^4.17.1",
-        "eslint": "8.0.0"
-    }
-}

package/tests/fixtures/leaky-app/src/index.js

@@ -1,21 +0,0 @@
-const express = require('express');
-const app = express();
-
-// Hardcoded secret (fake AWS key)
-const awsKey = "AKIA1234567890123456";
-
-// Missing env var usage (API_KEY is not in .env)
-const apiKey = process.env.API_KEY;
-
-// Debug mode enabled
-const config = {
-    debug: true
-};
-
-// CORS wildcard
-app.use(cors({ origin: '*' }));
-
-// Hardcoded DB credentials
-const db = "postgres://user:password@production-db.com/db";
-
-app.listen(process.env.PORT || 3000);

package/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2020",
-    "module": "commonjs",
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "resolveJsonModule": true
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "**/*.test.ts"]
-}